StackShip is an OpenTofu control plane with native cloud-protocol compatibility. It groups workspaces into projects, executes managed plans and applies in isolated sandboxes, evaluates deterministic Rego policy, binds human approval to exact evidence, versions state, and records sanitized audit events.
Terraform Cloud and HCP Terraform are migration sources and protocol compatibility targets. StackShip runs OpenTofu binaries only.
Product scope
The first release includes:
- identity with organizations, SSO, SCIM, and OAuth;
- projects and workspaces;
- any exact stable OpenTofu release from
1.6.0up; - native OpenTofu cloud discovery and
/api/v2compatibility; - durable managed plan and apply execution;
- GitHub App source ingestion and Checks;
- a private module registry publishing from GitHub semver tags;
- workspace variables and versioned credential profiles;
- immutable Rego policy versions;
- exact-evidence approval and rejection;
- immutable state history plus authenticated raw download; and
- a frozen native v1 dashboard API and sanitized audit inventory.
There is no billing surface. A StackShip-specific CLI, other VCS providers, customer-operated execution agents, scheduled drift scans, cost analysis, and general notification routing are not available today.
Product hierarchy
| Object | Meaning |
|---|---|
| Organization | Tenant and identity boundary |
| Project | Named grouping for related workspaces |
| Workspace | One configuration, state lineage, and serial run queue |
| Run | One immutable-input plan, policy, approval, and optional apply attempt |
Choose a path
Quickstart
Install the GitHub App, create a project and workspace, configure credentials, and inspect a managed run. Start the quickstart.
Migrate state
Move local or external cloud state through ordinary OpenTofu cloud commands. Read the migration guide.
Core concepts
Learn the durable identities and trust boundaries used by the product. Read core concepts.
Native cloud configuration
Configure hostname = "stackship.run" and use normal tofu commands.
Read about state and cloud discovery.